# (L1) Ensure the 'Password expiration policy' is set to 'Set passwords to never expire (recommended)'

1.3.1 (L1) Ensure the 'Password expiration policy' is set to 'Set passwords to never expire (recommended)'

Source: https://maester.dev/docs/tests/CIS.M365.1.3.1

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/nzlostboy" title="Ben Miles · Original author"><img src="https://github.com/NZLostboy.png" alt="Ben Miles" width="28" height="28" loading="lazy" decoding="async" /></a><a class="test-byline-avatar" href="/contributors/merill" title="Merill Fernando · Co-contributor"><img src="https://github.com/merill.png" alt="Merill Fernando" width="28" height="28" loading="lazy" decoding="async" /></a><a class="test-byline-avatar" href="/contributors/brianreidc7" title="Brian Reid · Co-contributor"><img src="https://github.com/brianreidc7.png" alt="Brian Reid" width="28" height="28" loading="lazy" decoding="async" /></a><a class="test-byline-avatar" href="/contributors/blindzero" title="Matthias · Co-contributor"><img src="https://github.com/blindzero.png" alt="Matthias" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/nzlostboy">Ben Miles</a> with 3 co-contributors</span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/cis">CIS</a> · Microsoft 365 · Organization settings · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId CIS.M365.1.3.1
```

## Overview

1.3.1 (L1) Ensure the 'Password expiration policy' is set to 'Set passwords to never expire (recommended)'

Microsoft cloud-only accounts have a pre-defined password policy that cannot be changed. The only items that can change are the number of days until a password expires and whether or not passwords expire at all.

#### Rationale

Organizations such as NIST and Microsoft recommend against arbitrarily requiring users to change their passwords after a set period, unless there is evidence of compromise or the user has forgotten the password. This guidance applies even to single-factor (password-only) scenarios, as forced, periodic changes often lead to weaker passwords and reduced security. Additionally, this Benchmark advises implementing multi-factor authentication (MFA) for all accounts, which further diminishes the value of password expiration policies. Long-lived passwords can be further strengthened by enabling additional password protection features in Entra ID.

#### Impact

When setting passwords not to expire it is important to have other controls in place to supplement this setting. See below for related recommendations and user guidance.

* Ban common passwords.
* Educate users to not reuse organization passwords anywhere else.
* Enforce Multi-Factor Authentication registration for all users.

#### Remediation action

To set Office 365 passwords are set to never expire:

1. Navigate to [Microsoft 365 admin center](https://admin.microsoft.com).
2. Click to expand **Settings** select **Org Settings**.
3. Click on **Security & privacy**.
4. Check the **Set passwords to never expire (recommended)** box.
5. Click **Save**.

##### PowerShell

1. Connect to the Microsoft Graph service using `Connect-MgGraph -Scopes "Domain.ReadWrite.All"`.
2. Run the following Microsoft Graph PowerShell command:

```powershell
Update-MgDomain -DomainId <Domain> -PasswordValidityPeriodInDays 2147483647
```

#### Related links

* [Microsoft 365 Admin Center](https://admin.microsoft.com)
* [NIST Special Publication 800-63B](https://pages.nist.gov/800-63-3/sp800-63b.html)
* [CIS Password Policy Guide](https://www.cisecurity.org/insights/white-papers/cis-password-policy-guide)
* [Password policy recommendations for Microsoft 365 passwords](https://learn.microsoft.com/microsoft-365/admin/misc/password-policy-recommendations?view=o365-worldwide)
* [CIS Microsoft 365 Foundations Benchmark v7.0.0 - Page 47](https://www.cisecurity.org/benchmark/microsoft_365)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | CIS.M365.1.3.1 |
| Severity | Medium |
| Suite | CIS |
| Product | Microsoft 365 |
| Related products | Entra ID |
| Feature | Organization settings |
| Area | Authentication |
| Resource type | Domain |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | None |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 1.3.1 |
| Benchmark level | L1 |
| Benchmark profiles | E3 Level 1 |
| Supports controls | cis-m365:1.3.1, nist-800-53-r5:IA-5(1) |
| PowerShell test | [Test-MtCisPasswordExpiry](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.1.3.1.ps1) |
| Services | Graph |

</details>

## Source

- Test: [`tests/cis/Test.CIS.M365.1.3.1.ps1`](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.1.3.1.ps1)
- Documentation: [`tests/cis/Test.CIS.M365.1.3.1.md`](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.1.3.1.md)